Adobe® ColdFusion® 10 Server Lockdown Guide

Setting Default Recommendation Description
Maximum number
of simultaneous
CFC function
requests
Maximum number
of simultaneous
Report threads
Maximum number
of threads available
for CFTHREAD
Timeout requests
waiting in queue
after
Request Queue
Timeout Page
15 1 if not using
Remote CFC
function requests,
otherwise tuned.
This setting applies only to CFC
functions that have access=remote
specified, as they are invoked using
/example.cfc?method=MethodName.
This applies to methods invoked via
the ColdFusion AJAX proxy as well.
If your applications do not make use
of this feature set to 1. Otherwise
use load testing to find the optimal
value for this setting.
1 1 Keep this value at 1 unless you are
using cfreport heavily.
10 1 if not using
cfthread, tuned
otherwise.
60 seconds 5 seconds (Match
Request Timeout)
Blank or
/CFIDE/administra
tor/templates/requ
est_timeout_error.
cfm
Set this value to 1 if you are not
using cfthread. If you do use
cfthread setting a value too high can
lead to context switching.
This setting can generally be set
equivalent to the Timeout Requests
After value specified in the Settings
section. A lower setting here can
mitigate the effectiveness of DOS
attacks.
Specified Specify a HTML file giving the user a
message to wait and retry their
request again. The message should
not disclose the fact that the queue
timed out.
64